CVE-2026-25942: 
NixOS vulnerability analysis and mitigation

CVE-2026-25942 is a global buffer out-of-bounds read vulnerability in FreeRDP's xf_rail_server_execute_result function, affecting all versions prior to 3.23.0. The flaw allows a malicious RDP server to trigger an out-of-bounds read by sending a crafted execResult value of 7 or greater in a TS_RAIL_ORDER_EXEC_RESULT PDU, which is then used without bounds checking to index a 7-element global array. It was disclosed on February 25, 2026, with a fix released in version 3.23.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is an improper array index bounds check (CWE-125: Out-of-bounds Read) in client/X11/xf_rail.c. The global error_code_names[] array contains exactly 7 string pointers (indices 0–6), but the xf_rail_server_execute_result function directly uses the server-supplied execResult->execResult field — a UINT16 parsed from the RAIL PDU — as an array index without any validation. When a server sends an execResult value ≥ 7, the code reads memory beyond the array boundary. The vulnerable call chain is: rail_read_server_exec_result_order (reads the unchecked UINT16 from the stream) → rail_recv_exec_result_order → xf_rail_server_execute_result (performs the out-of-bounds index). The fix in commit 9362a0b replaces the static array lookup with a bounds-safe error_code2str() function using a switch statement with a default fallback (GitHub Advisory, Fix Commit).

A malicious or compromised RDP server can trigger a client-side global buffer overflow read, causing the FreeRDP client (xfreerdp) to crash, resulting in a denial of service. The primary impact is on availability; confidentiality and integrity are not directly affected, as the vulnerability is a read-only out-of-bounds access. In environments where users routinely connect to untrusted RDP servers, this could be used to disrupt client sessions or potentially leak adjacent memory contents depending on memory layout (GitHub Advisory).

A proof-of-concept is documented in the official security advisory, requiring a RAIL-capable RDP server configured to respond with a TS_RAIL_ORDER_EXEC_RESULT PDU containing execResult = 7 or higher. The vulnerability is network-exploitable with no authentication or user interaction required beyond the client initiating an RDP connection with RemoteApp (/app) mode enabled. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.05%, indicating low probability of near-term exploitation (GitHub Advisory).

1. Set up a malicious RDP server: Configure a RAIL-capable RDP server (e.g., a custom or modified RDP server implementation) that supports the Remote Applications Integrated Locally (RAIL) protocol extension.
2. Wait for or lure a client connection: Induce a vulnerable FreeRDP client (version ≤ 3.22.0) to connect to the malicious server using RemoteApp mode, e.g., xfreerdp /v:<attacker-ip> /u:a /p:a /cert:ignore /app:program:notepad.exe.
3. Complete the RAIL handshake: Allow the normal RAIL handshake to complete so the client sends a ClientExec PDU requesting application launch.
4. Send malicious exec result: Respond with a crafted TS_RAIL_ORDER_EXEC_RESULT PDU containing an execResult field value of 7 or greater (e.g., 0x0007).
5. Trigger out-of-bounds read: The client's xf_rail_server_execute_result function indexes error_code_names[7], reading 8 bytes past the end of the 7-element global array, causing a crash (DoS) detectable via AddressSanitizer as a global-buffer-overflow (GitHub Advisory).

• Process: Unexpected crash or abort of the xfreerdp process, particularly when using /app (RemoteApp) mode; crash dumps referencing xf_rail_server_execute_result in client/X11/xf_rail.c.
• Logs: FreeRDP log entries showing RAIL exec error: execResult= with an unrecognized or numeric value ≥ 7; AddressSanitizer output reporting global-buffer-overflow at xf_rail.c:1016.
• Network: RDP traffic containing TS_RAIL_ORDER_EXEC_RESULT PDUs with execResult field values outside the range 0–6 (i.e., ≥ 0x0007) from the server to the client.

Upgrade FreeRDP to version 3.23.0 or later, which replaces the unsafe array index with a bounds-safe error_code2str() function (Fix Commit). If immediate patching is not possible, restrict FreeRDP client usage to connections with trusted, known-good RDP servers only, and avoid using RemoteApp (/app) mode with untrusted servers. Linux distribution packages (Fedora, Ubuntu, SUSE, openSUSE, Amazon Linux 2, Debian) have released updated packages incorporating the fix (GitHub Advisory).

The vulnerability was reported by security researcher ehdgks0627 and published as a GitHub Security Advisory by FreeRDP maintainer akallabeth on February 25, 2026. Coverage appeared on Phoronix noting the FreeRDP 3.23.0 release, and the issue was picked up by Linux security news aggregators including linuxsecurity.com and pro-linux.de. No significant threat actor attribution or broader industry controversy has been noted.